Criminals used exposed Cairn AI agent instances to breach more than 100 company websites
What happened
Reuters and NorForge reported that criminals used exposed instances of the open-source Cairn AI platform to run autonomous agents against e-commerce sites. Reuters counted websites of more than 100 companies breached; companies named include Deere, SharkNinja and Cummins. How much data was taken is not known.
NorForge researcher Snorre Fagerland found the activity while scanning for accidentally exposed Cairn instances. Cairn is an open-source AI problem-solving platform. From about 2 October he identified roughly two dozen instances used for malicious work. The most prolific operator began on 25 September and aimed at e-commerce sites in the US, Canada, Australia and Japan, giving agents instructions of under 100 Chinese characters. Successful intrusions typically took about 23 hours. Reuters reports that the campaign appeared to use DeepSeek and Anthropic's Claude Code, at roughly 5,000 dollars in tokens, or about 50 dollars per successful hack.
The largest cluster was linked to 14 exposed panels holding more than 1,100 attack projects. Other operators stole credit card data or tried to rob a cryptocurrency exchange. Reuters identified victims by reviewing the operator's Cairn records. It counted websites of more than 100 companies breached, out of more than 1,200 targeted, and could not tell how much data was taken. Two smaller businesses also acknowledged being compromised.
How it happened
AI-run attack: Autonomous intrusion. The attacker's own AI agent carried out the break-in, working through the steps with little human involvement.
The software involved works with many AI models, so no single model maker was involved. The product was Cairn, which is open source, a type of AI agent.
Impact
Data was exposed. Data involved: unknown. Many organizations were affected.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 19 Oct 2026.
Deere said it took remediation actions and saw no indication that sensitive information was accessed. SharkNinja said a standalone product-support site was affected and the threat was contained. Cummins said it was investigating a possible attack on a website run by a third-party vendor. The Cairn author said the platform was not designed for hacking and did not answer Reuters' questions.